VDB
ICSA-25-135-04
ICSA-25-135-04
PUBLISHED
CVSS 7.5 HIGH
Record from circl · Published May 13, 2025
Desigo CC deployments that use Installed Client are impacted by an information disclosure vulnerability which could result in information leak from the Desigo CC server. The other Desigo CC client options, Windows App Client and Flex Client, are not affected by this vulnerability. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Desigo CC |
Timeline
- May 13, 2025 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ICSA-25-135-04
vulnetix vdb fixes ICSA-25-135-04Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ICSA-25-135-04/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://cert-portal.siemens.com/productcert/html/ssa-523418.html advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-04 advisory
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B url
- https://cert-portal.siemens.com/productcert/csaf/ssa-523418.json advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-135-04.json advisory
- https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url